Analyzing a PDF File

[carl_6924]

Hello,

I recently have been analyzing a PDF file using different tools such as peepdf, pdf-parser, Process Monitor, Procdot, and VirusTotal.  During my analyzation of the behavior of the file on VirusTotal, I noticed that there are a few files written that look concerning.  Can anyone help me identify them and inform me of whether or not they are potentially malicious?

A brief description of the nature of the file is it is supposed to be a document that contains nothing but text.

Peepdf informed me that there are over one hundred compressed objects.

The following files are only a few concerning looking files dropped  by the PDF file.

• C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF57dc10.TMP (copy)

• C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

• C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

The following is a few of the many concerning files opened by the PDF file:

• C:\Users\<USER>\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.dbC:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b

• C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\Comctl32.dl

• C:\Program Files\Common Files\Microsoft Shared\OFFICE16\msoshext.dll
• C:\Program Files\Common Files\System\wab32.dll
• C:\Program Files\Google\Chrome\Application
• C:\Program Files\Google\Chrome\Application\97.0.4692.99
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\C:\Program Files\Windows Defender\ShellExt.dll
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\MEIPreload\manifest.json
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\MEIPreload\preloaded_data.pb
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\WidevineCdm\manifest.json
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome.dll
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome_100_percent.pak
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome_200_percent.pak
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome_elf.dll
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\default_apps\
• C:\Program Files\Google\Chrome\Application\97.0.4692.99\default_apps\external_extensions.json

Can anyone help explain what is going on?

[Karl Heinz Kremer]

It looks like you are opening the PDF file in Chrome. You would have to talk to the Chrome developers about how they are handling PDF files. 

[carl_6924]

Thank you for clarifying the Chrome aspect for me.  I'm a little concerned about this line though:

C:\Program Files\Google\Chrome\Application\97.0.4692.99\C:\Program Files\Windows Defender\ShellExt.dl

Is there a reason why its opening my Windows Defender?

[Karl Heinz Kremer]

This again is a clear Chrome reference.